Original reporting and feature articles on the latest privacy developments

N.H. Pharma Law May Set Precedent for Other States

New Hampshire has become the unlikely front in the latest battle between the pharmaceutical industry and privacy advocates. In June 2006, New Hampshire passed its "Prescription Confidentiality Act," which bars the license, transfer, use or sale for any commercial purpose of patient-identifiable or prescriber-identifiable information. Supporters of the law argue that it protects the privacy of doctors and patients who use prescriptions, while at the same time helping control the rising healthcare costs. But the pharmaceutical industry - which has dubbed it the "Prescription Restraint Law" - argue that the measure is as unconstitutional as it is wrong-headed. They assert that the law will limit valuable information provided to prescribing doctors and researchers, all to the ultimate detriment of patients.

More than just a philosophical battle, privacy supporters - represented by the state of New Hampshire - and the pharmaceutical industry - led by IMS Health Incorporated and Verispan, LLC - recently concluded a five-day trial precipitated by the pharmaceutical industry's challenge to the law. The trial's outcome will likely have nationwide impact, as at least six other states have similar pending legislation. At the federal level, several congressmen have introduced The Prescription Privacy Protection Act, which would enact a similar law.

"Honey, Are You Sitting Down?" Rep. Cindy Rosenwald sponsored the Prescription Confidentiality Act, New Hampshire House Bill 1346, in early 2006. Her husband - a cardiologist - had alerted her to a pharmaceutical sales representative's intimate knowledge of his prescription histories. In fact, although most consumers are completely unaware of it, there is a long-established and widespread practice of collecting specific information from pharmacies about every prescription they fill and selling it to pharmaceutical manufacturers.

In Rosenwald's view, as expressed in the bill's introduction, "Not only is patient identity inappropriately used for pharmaceutical marketing, but the identity of the prescribers - doctors, nurse practitioners, optometrists and assistants - is routinely bought and sold for marketing. â€¦ The use of personal identities prove an unwarranted intrusion into professional privacy and, more to the point, it adds to the financial burden of New Hampshire's health care system by increased pharmaceutical costs for the state, our consumers, and our businesses."

The law bars any pharmacy, pharmacy benefits manager, insurance company or other similar entity from licensing, transferring, using or selling prescription information containing patient-identifiable and prescriber-identifiable data for commercial purposes, other than the limited purposes of pharmacy reimbursement, care management and the like. It also specifically defines "commercial purpose" as including advertising, marketing, promotion or any activity that could be used to influence sales or market share of a pharmaceutical product, influence or evaluate the prescribing behavior of an individual healthcare professional, or evaluate the effectiveness of a professional pharmaceutical sales force. It does not bar, however, the collection and use of patient and prescriber "de-identified" data by zip code, geographic region, or medical specialty for commercial purposes. It specifies that a violation of these terms is considered an unfair or deceptive act or practice, subjecting violators to civil and potentially criminal penalties.

It is interesting to note that the law passed quickly and almost unanimously, and, according to the Nashua Telegraph, prompted Rosenwald's cell phone call and excited exclamation to her husband, "Honey, are you sitting down? Guess what just happened?!" Rosenwald attributed the swift passage to the simple fact that "New Hampshire folks don't like people invading their privacy." But at the same time, there were supposed economic concerns underlying its adoption, since legislators were of the opinion that pharmaceutical sales representatives used the information to drive the prescription of higher-priced medicine. New Hampshire's Medicaid costs for prescription drugs have risen 84 percent in the last five years.

The Industry's Challenge A variety of pharmaceutical and medical players, including the New Hampshire Association of Chain Drug Stores, scientists from the Mayo Clinic and at least two health information companies, IMS Health and Verispan, LLC, opposed the measure. With $1.7 billion in annual sales, IMS Health is the world's leading provider of market intelligence to the pharmaceutical and healthcare industries. Similarly, Verispan provides a broad array of information, products and services to the healthcare industry, including market research audits, healthcare profiles and pharmaceutical data analysis and consulting. To these companies and others, the law is a step in the wrong direction.

"By effectively denying access to prescriber-identified data, the new law will have significant unintended consequences and go against the national movement towards making healthcare information more accessible and transparent," stated Robert H. Steinfeld, IMS Senior Vice President and General Counsel, in an IMS news release: "The success of initiatives to improve health care quality, and ensure patient safety and manage costs depends on access to more information, not less."

The opposition further points out that the database it creates with this pharmaceutical information is used for research that benefits all patients. As one New Hampshire think tank commentator told Medical Marketing & Media: "What the people voting for this didn't think about is that the database created by the tracking of prescriptions is not just extraordinarily valuable, it's also very expensive to create, and its creation is only possible because of its commercial use."

These arguments gained little traction, and, as noted, the law passed and became effective on June 30, 2006.

Within days, IMS Health and Verispan sued in U.S. District Court to have all, or part of the law, declared unconstitutional on the grounds that it constitutes a violation of the First Amendment and the Commerce Clause of the U.S. Constitution. Because the First Amendment is implicated, the state must show that the law passes the "Strict Scrutiny Test" - that is, it must be narrowly tailored to promote a compelling government interest, and if a less restrictive alternative would serve the government's purpose, the legislature must use that alternative. With respect to the Commerce Clause argument, the challengers must prove the law has a practical effect of controlling commerce that takes place wholly outside of New Hampshire's borders, constituting a per se violation of the Commerce Clause.

Although the Federal District Court in New Hampshire declined to enter an immediate injunction of the law, it "fast-tracked" the proceedings.

Conclusion A number of states have considered similar "prescription confidentiality" legislation, including New York, Massachusetts, Pennsylvania, Illinois and California, which together represent roughly half of a national prescribing volume. The outcome could be a case of whither goes New Hampshire, so goes the nation. This is especially true in the privacy area, where states appear to take a "me too" approach to privacy legislation, as witnessed in the passage of data breach and security freeze laws throughout the country. The court's decision is expected in the next 30 days.

Luis Salazar is a shareholder with Greenberg Traurig and a founding member of the firm's Data Privacy and Security Law Taskforce. Salazar is also the drafter of the Privacy Policy Enforcement in Bankruptcy Act, an amendment to the Bankruptcy Code that prohibits bankrupt companies from misusing consumers' personally identifying information and provides for the appointment of a Consumer Privacy Ombudsman to advise Bankruptcy Courts on privacy issues. Salazar is based in the firm's Miami office and can be reached at

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Editor's Note: At press time, The Privacy Advisor learned that U.S. District Court Judge Paul Barbadoro ruled in favor of Verispan LLC and IMS Health Inc. In his 54-page ruling, Barbadoro stated that ordinarily "states should be given wide latitude to choose among rational alternatives when they act to benefit the public interest." But he added, "However, when states adopt speech restrictions as their method, courts must subject their efforts to closer scrutiny." Watch for more coverage of this decision in upcoming issues of the Advisor.

0 Comments

If you want to comment on this post, you need to login

Related

Several witnesses appeared before the House Energy and Commerce subcommittee on Tuesday to testify about the rapidly growing Internet-of-Things (IoT) ecosystem. With approximately 25 billion connected devices in existence, and counting, the economic benefits and job opportunities in IoT appears to be eclipsing any significant Congressional motivation to regulate this landscape.
In fact, the hearing followed an IoT showcase hosted by the subcommittee to demonstrate many of the technological inno...
Read more

This week, Alamo Broadband and USTelecom each sued to block the Federal Communications Commission from enforcing its February order reclassifying broadband providers as “common carriers," or a public utility of sorts, and therefore subject to the same rules that regulate telecommunications companies. The suits exemplify a panicked stakeholder reaction to a potentially disruptive change: Some personal data Internet service providers currently use to generate revenue is now considered Consumer Pro...
Read more

National Security Agency (NSA) General Counsel Rajesh De has left the post he held for the last three years and is headed to private practice. He says while his time at the NSA was certainly "busy," he was one of many leaders at the agency he describes as very collaborative.
Read more

The European Court of Justice has heard arguments in a case originally brought by Austrian law student Max Schrems that was referred up the line to the EU's highest adjudicators. At issue is this: Does the Safe Harbor program adequately protect the rights of EU citizens when "compliant" companies are known to share EU citizen data with U.S. intelligence bodies?
Read more

Global interoperability. Privacy leadership. The right to be forgotten. Glenn Greenwald. This month's IAPP Global Privacy Summit had it all and generated, and continues to generate, a lot of news. In case you missed any of the headlines, here's a roundup of some of the stories we reported.
Read more

Tags

The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally.Learn more

The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.